GnuTLS | certtool: --verify-profile option does not override system-wide priority configuration (#1772)
Read-only notification of GnuTLS library development activities <[email protected]>
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
Conor Tull created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1772
When `certtool` is run on a system that utilizes a system-wide priority configuration (via `GNUTLS_SYSTEM_PRIORITY_FILE`), the system-wide defaults appear to take priority over the explicit command-line argument `--verify-profile` .
If the system policy enforces a security floor (e.g., 2048-bit RSA), passing `--verify-profile low` fails to allow verification of smaller keys (e.g., 1792-bit), returning a `GNUTLS_SEC_PARAM_MEDIUM` error.
**Steps to Reproduce:**
1. On a system with strict crypto-policies or by pointing `GNUTLS_SYSTEM_PRIORITY_FILE` to a strict config.
2. Generate a 1792-bit RSA key and self-signed certificate (simulating legacy artifacts).
3. Attempt to verify the certificate using the `low` profile.
`cat < legacy.cfg cn = "Test-Legacy" serial = 001 expiration_days = 1 signing_key encryption_key cert_signing_key ca EOF`
`GNUTLS_FORCE_FIPS_MODE=0 certtool --generate-privkey \
--rsa --bits 1792 --outfile 1792.key`
`GNUTLS_FORCE_FIPS_MODE=0 certtool --generate-self-signed \
--load-privkey 1792.key \
--template legacy.cfg \
--outfile 1792.pem`
`certtool --verify \
--verify-profile low \
--infile 1792.pem --load-ca-certificate 1792.pem`
**Actual Results:** The command fails even though `low` was requested. Debug logs (`-d 9`) show that the library asserts `GNUTLS_SEC_PARAM_MEDIUM`, indicating the system default is overriding the CLI flag.
`|<2>| GNUTLS_SEC_PARAM_MEDIUM: certificate's security level is unacceptable`\
`Chain verification output: Not verified. The certificate is NOT trusted.`
The CLI argument `--verify-profile low` should take precedence over the system configuration file. The user is explicitly opting into allowing weaker keys for this specific operation. If `GNUTLS_SYSTEM_PRIORITY_FILE=''` is included it works successfully.
`# This works successfully:
GNUTLS_SYSTEM_PRIORITY_FILE='' certtool --verify \
--verify-profile legacy \
--infile 1792.pem --load-ca-certificate 1792.pem
`
This suggests the issue is strict precedence logic where the system config is treated as a hard floor rather than a default.
--
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1772
You're receiving this email because of your account on gitlab.com.
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel